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Top Stories 

• A Louisiana official reported March 27 that more than 5 million gallons of gasoline 
shipped from ExxonMobil’s Baton Rouge, Louisiana terminal was tainted by something 
causing valve and intake systems issues for vehicles. - Baton Rouge Advocate (See item 1) 

• About 8 million pounds of plastic tubing was damaged by a March 27 fire in a plastic- 
containing lot at WL Plastics in Mills, Wyoming, causing an estimated $8 million to $10 
million in damage. - Casper Star-Tribune (See item 3) 

• The Industrial Control Systems Computer Emergency Response Team (ICS-CERT) issued 
a notice March 27 advising users of 1 1 Schneider Electric industrial control system 
products that a patch is available for a stack-based overflow vulnerability in Schneider’s 
modbus driver. - Threatpost (See item 24) 

• Researchers discovered a new malware worm that infects systems via an infected 
Microsoft Word or Excel file and then gathers information on the compromised system. - 
Help Net Security (See item 25) 
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Energy Sector 



1. March 28, Baton Rouge Advocate - (Louisiana) La. official: Exxon’s bad fuel totals 5 
million gallons. Louisiana’s commissioner of agriculture and forestry reported March 
27 that more than 5 million gallons of gasoline shipped from ExxonMobil’s Baton 
Rouge terminal was tainted by something causing valve and intake systems issues for 
vehicles. The terminal remained closed while authorities continue testing in order to 
determine the cause of the bad fuel. 

Source: http://theadvocate.com/news/business/8745898-123/40-or-50-cases-of 

2. March 27, Portland Oregonian - (Oregon) Oil train terminal near Clatskanie hit 
with $117,000 fine by Oregon DEQ. The Oregon Department of Environmental 
Quality proposed a $1 17,292 fine March 27 for the Global Partners LP-owned 
Columbia Pacific Bio-Refinery near Clatskanie after the department alleged the 
company violated State law by moving more crude oil than it was allowed. The 
terminal is seeking an air pollution permit that would allow it move 1.8 billion gallons 
of oil annually. 

Source: 

http://www.oregonlive.com/environment/index.ssf/2014/03/oil train terminal near cla 
tsk l.html 



For another story, see item 24 
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Chemical Industry Sector 

3. March 27, Casper Star-Tribune - (Wyoming) Investigators call in arson specialists 
for Mills plastic fire; cause remains unknown. About 8 million pounds of plastic 
tubing was damaged by a March 27 fire in a plastic-containing lot at WL Plastics in 
Mills, Wyoming, causing an estimated $8 million to $10 million in damage. No injuries 
were reported and no structures were damaged. 

Source: http://billingsgazette.com/news/state-and-regional/wvoming/investigators-call- 
in-arson-specialists-for-mills-plastic-fire-cause/article 95d03bel-d09f-588d-8a97- 
a5d8f388cle2.html 



For another story, see item 24 
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Nuclear Reactors, Materials, and Waste Sector 

See item 24 
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Critical Manufacturing Sector 
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See item 24 
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Defense Industrial Base Sector 

See item 24 
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Financial Services Sector 

4. March 28, North Andover Eagle-Tribune - (Massachusetts) ‘Massive credit card 
counterfeiting’ scheme uncovered. A man was arrested in Haverhill March 21 on 
suspicion of being part of a payment card counterfeiting scheme after he was spotted 
making several purchases with suspicious cards, which led to a search of his home 
where police found blank cards and card- making materials. Police also found ID card 
printers and medical grade security paper that they allege the suspect was using to 
create counterfeit prescriptions. 

Source: http://www.eagletribune.com/haverhill/xl387891499/Massive-credit-card- 
counterfeiting- scheme-uncovered 

5. March 27, KXTV 10 Sacramento - (California) ‘Bad Beard Bandit’ arrested for area 
bank robberies. A Half Moon Bay man was arrested March 27 and is suspected of 
being the “Bad Beard Bandit” responsible for robbing eight banks in northern and 
central California between November 2013 and February 2014. 

Source: http://www.newsl0.net/story/news/local/manteca/2014/03/27/bad-beard- 
bandit-bank-robber-arrest/6977439/ 

[ Return to top ] 

Transportation Systems Sector 

6. March 28, Salt Lake Tribune - (Utah) 1-84 closed down by fatal crash involving 
semis, cars. A multi- vehicle accident involving at least 3 semi-trucks and 1 1 cars 
closed a stretch of Interstate 84 westbound in north Summit County for several hours 
March 28. One person died in the crash and two others were transported to area 
hospitals. 

Source: http://www.sltrib.com/sltrib/news/57743276-78/closed-highwav-royce- 
westbound.html.csp 

7. March 27, Associated Press - (Arizona) Stretch of eastern Arizona highway reopens 
after overnight closure due to police situation. The Arizona Department of 
Transportation reported that a 10-mile stretch of U.S. 70 in San Carlos reopened March 
27 after a nearly 12-hour closure due to a police situation. 

Source: 

http : //www. greenfieldreporter.com/view/story/b59b6fc3cec44a2 1 94a4f5e8 5 2ae98f8/A 



- 3 - 



Z— Highway-Closed 



8. March 27, KGW 8 Portland - (Oregon) All lanes re-opened after mudslide on Hwy 
6. The Wilson River Highway in Glenwood reopened March 27 after crews removed 
dirt and debris left by a March 26 mudslide. 

Source: http://www.kgw.com/news/Mudslide-closes-Wilson-River-Hwy-on-OR-coast- 
252530971.html 

9. March 27, KWWL 7 Waterloo - (Iowa) Fire forces evacuation at Eastern Iowa 
Airport. A Delta Airlines flight departing from Eastern Iowa Airport was forced to 
evacuate March 27 due to a small fire that broke out in the auxiliary power unit. 

Source: http://www.kwwl.com/storv/25091880/2014/03/27/fire-forces-evacuation-at- 
eastern-iowa-airport 

10. March 27, CNN - (Illinois) O’Hare train crash: Driver fell asleep, system failed, 
NTSB says. The U.S. National Transportation and Safety Board announced March 26 
that the operator of the Chicago Transit Authority Blue Line train that barreled through 
the protective end bumper of its stop at Chicago’s O’ Hare International Airport, leaving 
32 people injured March 24, fell asleep at the controls while the emergency braking 
systems failed to activate. 

Source: http://www.cnn.com/2014/03/27/us/chicago-ohare-train-derailment/ 

For another story, see item 24 
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Food and Agriculture Sector 

11. March 27, Associated Press - (New York) Disaster declared for vineyards in 19 
upstate counties. The U.S. Department of Agriculture issued a disaster declaration in 
19 upstate New York counties March 26 after severe winter weather caused extensive 
damage to the vineyards in the Finger Lakes wine region. Federal assistance is 
available to farmers and growers in the region in an effort to aid recovery. 

Source: http://cnvnews.com/disaster-declared-for-vinevards-in-19-upstate-ny-counties/ 

12. March 27, WLS 7 Chicago - (Illinois) Illinois salmonella outbreak linked to 
Mexican-style cheese. Illinois health officials linked a Salmonella outbreak that 
sickened 100 people in 13 counties to Mexican-style cheese that was made illegally. 
The Illinois Health Department warned people to check the labeling of products to 
make certain the product was made by a licensed dairy farmer. 

Source: http://abclocal.go.com/wls/storv?section=news/local/illinois&id=9482532 

13. March 27, Reuters - (National) GSK recalls weight-loss drug Alii in U.S. on 
tampering concerns. GlaxoSmithKline issued a recall of all supplies of its non- 
prescription weight loss drug Alii, from U.S. and Puerto Rico retailers after consumers 
in 7 States reported finding tablets and capsules that were not the product in some 
bottles. The company is working with the U.S. Food and Drug Administration to 
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investigate the tampered products. 

Source: http : //w w w .reuters . com/article/20 1 4/03/27 /u s - gsk-alli- 
idUSBREA2Q12K20 140327 

14. March 27, U.S. Food and Drug Administration - (National) Macadamia nut allergy 
alert and voluntary recall of 15-count boxes of Chocolate Chunk LUNA® Bars 
due to package mislabeling. The U.S. Food and Drug Administration announced that 
Cliff Bar & Company voluntarily recalled 15-count boxes of its Chocolate Chunk 
LUNA Bars due to mislabeling and undeclared macadamia nuts. 

Source: http://www.fda.gov/Safety/Recalls/ucm390934.htm 

15. March 27, U.S. Food and Drug Administration - (International) BBM Chocolate 
Distributors, Ltd. issues allergy alert on undeclared milk in "CHOCOLAT 
Alprose 52% CACAO PREMIUM DARK CHOCOLATE, Alprose Swiss 
Chocolate Dark Chocolate and CHOCOLAT Alprose NAPOLITAINS 
SWITZERLAND”. BBM Chocolate Distributors, Ltd., recalled all lots of its 
CHOCOLAT Alprose 52% CACAO PREMIUM DARK CHOCOLATE, Alprose 
Swiss Chocolate Dark Chocolate and CHOCOLATE Alprose Napolitains due to 
undeclared milk. The recall was initiated after testing by the Canadian Food Inspection 
Agency revealed that the product contained milk that was not declared. 

Source: http://www.fda.gov/Safety/Recalls/ucm390844.htm 

16. March 26, Gadsden Times - (Alabama) Roughly 300 dead chickens dumped on 
abandoned Etowah County road. Officials are investigating after the carcasses of 
more than 300 full-grown chickens were illegally dumped on an abandoned Etowah 
County road. The Alabama Department of Agriculture approved of the chickens being 
buried on site. 

Source: 

http://www.tuscaloosanews.com/article/20140326/NEWS/140329774/1007?Title=Rou 

ghlv-300-dead-chickens-dumped-on-abandoned-Etowah-County-road-&tc=ar 
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Water and Wastewater Systems Sector 

17. March 27, Lansing State Journal - (Michigan) BWL’s water treatment plant repairs 
cost $23M. The Lansing Board of Water & Light (BWL) announced March 27 that 
they expect to have their Wise Road water treatment plant in Lansing fully repaired and 
automation restored by the end of March after it was heavily damaged and shut down in 
2011 when a truck driver mistakenly pumped a load of liquid bleach into a fluoride 
tank, creating a cloud of highly-corrosive vapor. 

Source: 

http://www.lansingstateiournal.com/article/20140327/NEWS01/303270043/BWL-s- 

water-treatment-plant-repairs-cost-23M 
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Lor another story, see item 24 
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Healthcare and Public Health Sector 

Nothing to report 
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Government Facilities Sector 

18. March 28, Greenville Daily News - (Michigan) Greenville school bus tips over, 
students receive minor injuries. An accident involving a Greenville Public Schools 
bus March 28 left five students with minor injuries after the bus tipped over onto its 
side due to slippery road conditions in Fairplain Township. 

Source: http://thedailvnews.cc/2014/03/28/iust-in-greenville-school-bus-tips-over- 
about-a-dozen- students-inj ured/ 

19. March 28, Associated Press - (Pennsylvania) Luzerne County Community College 
closed because of threat. All Luzerne County Community College campuses in 
Nanticoke remained closed March 28 after receiving a threat by computer March 27 
which prompted officials to evacuate the campus and dismiss classes. 

Source: 

http://www.pennlive.com/midstate/index.ssf/2014/03/luzerne county community coll 
e.html 

20. March 27, Racine Journal Times - (Wisconsin) Parkside students’ data may have 
been exposed by computer virus. The University of Wisconsin-Parkside notified 
approximately 15,000 former and current students March 27 that their personal data 
may have been exposed due to a breach of the school’s system after a computer virus 
was found on the server. The university discovered the attack March 16 and is working 
to mitigate the incident. 

Source: http://iournaltimes.com/news/local/parkside-students-data-mav-have-been- 
exposed-by-computer- virus/article 4f648eea-b5e2-lle3-a313-0019bb2963f4.html 

21. March 27, KNSD 39 San Diego - (California) UCSD building evacuated due to gas 
leak. The EBU1 building at Warren Mall at the University of California San Diego was 
evacuated and closed for several hours March 27 due to a hazardous gas leak that 
caused three people to be transported to an area hospital. The leak was prompted by a 
worker installing a new air-control system who accidentally cut into a duct prompting 
residual gas to release. 

Source: http://www.nbcsandiego.com/news/local/UCSD-Hazmat-Evacuation-Warren- 
Mall- Voight-Drive-25269308 1 .html 

For additional stories, see items 24 and 27 
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Emergency Services Sector 



22. March 28, WCAU 10 Philadelphia - (Pennsylvania) Main Line ambulance station 
catches fire. Five ambulances and an evacuation bus were damaged after a March 28 
fire at the Volunteer Medical Service Corps of Lower Merion and Narberth 
Ambulance-Medic 313 station in Ardmore. The cause of the fire is under investigation. 
Source: http://www.nbcphiladelphia.com/news/breaking/Ambulance-Fire-Narberth- 
252861351.html 

23. March 28, KFDA 10 Amarillo - (Texas) Area jail evacuated due to gas leak. Inmates 
at the Hutchinson County Jail in Stinnett were evacuated and temporarily moved to 
other area jails March 26 due to a malfunctioning main gas regulator which caused a 
carbon monoxide leak. The jail remained closed March 27 for repairs and to air out the 
building. 

Source: http://www.newschannell0.com/story/25096422/area-iail-evacuated-due-to- 
gas-leak 
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Information Technology Sector 

24. March 28, Threatpost - (International) Critical vulnerabilities patches in Schneider 
Electric serial modbus driver. The Industrial Control Systems Computer Emergency 
Response Team (ICS-CERT) issued a notice March 27 advising users of 11 Schneider 
Electric industrial control system products that a patch is available for a stack-based 
overflow vulnerability in Schneider’s modbus driver. The vulnerable driver is used in a 
variety of industries, including energy, nuclear power, government facilities, 
transportation systems, and dams. 

Source: http://threatpost.com/critical-vulnerabilities-patched-in-schneider-electric- 
serial-modbus-driver/105 100 



25. March 28, Help Net Security - (International) Uncommon new worm targets Word 
and Excel files. Researchers at Trend Micro discovered a new malware worm known 
as Crigent that infects systems via an infected Microsoft Word or Excel file, 
communicates with a command and control (C&C) server via TOR and Polipo to 
obscure traffic, and then gathers information on the compromised system. The worm 
then changes other Word and Excel files on the infected system to older file formats 
and uses them to attempt to spread itself to other systems. 

Source: http://www.net-security.org/malware news.php?id=2748 

26. March 28, Softpedia - (International) Cybercriminals hijack WordPress websites 
with free premium plugins. Sucuri researchers found that several premium WordPress 
plugins available for free on some Web sites contain code that allows the plugins’ 
creator to create a new administrator account and gain control of WordPress sites that 
use the free premium plugins. 

Source: http://news.softpedia.com/news/Cybercriminals-Hiiack-WordPress-Websites- 
W ith-Free-Premium-Plugins-4346 1 6 .shtml 
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27. March 27, SC Magazine - (International) WinRAR spoofing vulnerability being 
exploited in malware campaign. A vulnerability in the WinRAR .zip file compressor 
identified by a security researcher was seen in a malware campaign targeting 
government, international, and business organizations. IntelCrawler researchers spotted 
the campaign, which uses the vulnerability to disguise the contents of .zip files, and 
found that a Zeus-like trojan is being used to establish remote administration channels 
and collect information. 

Source: http://www.scmagazine.com/winrar-spoofing-vulnerabilitv-being-exploited-in- 
malware-campaign/article/340135/ 

28. March 27, U.S. Consumer Product Safety Commission - (International) Lenovo recalls 
battery packs for ThinkPad notebook computers due to fire hazard. Lenovo 
announced a recall March 27 of about 37,400 battery packs for ThinkPad notebooks in 
the U.S. and Canada due to an issue that can cause them to overheat, posing a fire 
hazard. 

Source: http://www.cpsc.gov/en/Recalls/2014/Lenovo-Recalls-Battery- 
Packs-for-ThinkPad-Notebook-Computers/ 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

Nothing to report 
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Commercial Facilities Sector 

29. March 28, WABC 7 New York City - (New Jersey) Jersey City fire scorches 3 
buildings; 1 collapses. A small fire that broke out in a Jersey City produce store spread 
to the apartments above and to at least 2 nearby buildings that contain stores and 
apartments, leading to a 5-alarm fire that eventually collapsed one building March 28. 
Between 5 and 8 people were displaced and a second building will have to be 
demolished as a result of the fire. 

Source: 

http://abclocal.go.com/wabc/storv?section=news/local/new jersey&id=948291 1 

30. March 26, KSTU 13 Salt Lake City - (Utah) Extension cord sparks $500K condo fire 
in Roy. Fire officials believe an extension cord was to blame for a 3-alarm fire that 
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broke out March 26 at a condominium building in Roy, Utah, and caused an estimated 
$500,000 in damage. 

Source: http://foxl3now.com/2014/03/26/crews-battling-apartment-fire-in-roy/ 
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Dams Sector 

See item 24 
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Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 

About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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